Pittsburgh Ransomware Filtering and Remediation Expertise

Ransomware has become the weapon of choice for the major cyber-crime organizations and bad-actor states, posing a potentially lethal threat to businesses that fall victim. Modern variations of crypto-ransomware go after everything, including backup, making even selective restoration a complex and costly exercise. New versions of ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, Conti and Nephilim have made the headlines, displacing Locky, Spora, and NotPetya in prominence, elaborateness, and destructive impact.

Most crypto-ransomware penetrations are caused by innocent-seeming emails that include dangerous hyperlinks or attachments, and a high percentage are "zero-day" attacks that can escape detection by legacy signature-based antivirus (AV) tools. While user training and up-front identification are important to defend against ransomware attacks, best practices demand that you assume some attacks will inevitably succeed and that you put in place a strong backup mechanism that allows you to restore files and services quickly with little if any losses.

Progent's ProSight Ransomware Vulnerability Assessment is an ultra-affordable service centered around an online discussion with a Progent security expert skilled in ransomware defense and repair. During this assessment Progent will cooperate directly with your Pittsburgh network management staff to gather critical data about your cybersecurity configuration and backup processes. Progent will use this information to produce a Basic Security and Best Practices Report detailing how to apply leading practices for implementing and administering your security and backup systems to prevent or recover from a ransomware attack.

Progent's Basic Security and Best Practices Report focuses on key areas associated with crypto-ransomware prevention and restoration recovery. The report addresses:

Security

• Correct use of administration accounts
• Appropriate NTFS and SMB (Server Message Block) authorizations
• Proper firewall setup
• Safe Remote Desktop Protocol (RDP) access
• Guidance for AntiVirus (AV) filtering identification and configuration

• Split permission architecture for backup integrity
• Backing up required servers including AD
• Geographically dispersed backups with cloud backup to Azure

About Ransomware
Ransomware is a form of malware that encrypts or steals a victim's files so they cannot be used or are publicized. Crypto-ransomware sometimes locks the victim's computer. To avoid the damage, the target is asked to send a specified amount of money (the ransom), typically via a crypto currency like Bitcoin, within a short time window. There is no guarantee that delivering the extortion price will restore the damaged files or prevent its exposure to the public. Files can be altered or deleted across a network depending on the target's write permissions, and you cannot solve the strong encryption algorithms used on the hostage files. A typical ransomware delivery package is booby-trapped email, whereby the victim is lured into responding to by a social engineering exploit called spear phishing. This causes the email message to look as though it came from a familiar source. Another common attack vector is a poorly protected Remote Desktop Protocol port.

The ransomware variant CryptoLocker opened the modern era of crypto-ransomware in 2013, and the monetary losses caused by different strains of ransomware is said to be billions of dollars per year, roughly doubling every other year. Famous attacks are Locky, and NotPetya. Current headline variants like Ryuk, DoppelPaymer and Cerber are more sophisticated and have caused more havoc than earlier versions. Even if your backup/recovery procedures allow your business to restore your encrypted files, you can still be hurt by exfiltration, where ransomed data are exposed to the public (known as "doxxing"). Because new variants of ransomware are launched daily, there is no certainty that conventional signature-matching anti-virus tools will block the latest attack. If an attack does show up in an email, it is important that your end users have learned to be aware of phishing techniques. Your ultimate defense is a solid scheme for scheduling and keeping remote backups plus the use of reliable restoration platforms.

Contact Progent About the ProSight Crypto-Ransomware Readiness Evaluation in Pittsburgh
For pricing details and to find out more about how Progent's ProSight Ransomware Susceptibility Assessment can enhance your defense against ransomware in Pittsburgh, call Progent at 800-462-8800 or see Contact Progent.